aboutsummaryrefslogtreecommitdiff
path: root/pbuilder.8
Commit message (Collapse)AuthorAge
* Bug#579028: pbuilder: installs untrusted packages without askingSimon Ruderich2012-03-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Package: pbuilder Version: 0.206 Tags: patch Followup-For: Bug #579028 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Dear Maintainer, The attached patch changes the defaults to always enforce signed repositories and aborts if an untrusted/manipulated package is installed. It adds the new option --keyring (APTKEYRINGS) to add additional keyrings, which are then used to verify the (local) signed repositories. This way no untrusted packages can be installed. To still allow untrusted/unsigned repositories - they are a very bad idea and allow remote attackers performing a MITM to take over the system, including all built packages - the new option - --allow-untrusted (ALLOWUNTRUSTED) was added. I tested it with the official Debian repository, signed and unsigned local repositories and it works fine for me. But I'm only a "normal" pbuilder user, so I might have missed something. Please test the patch. I haven't tested it with cdebootstrap, but it should work as well. The old PBUILDERSATISFYDEPENDSOPT --check-key option was deprecated and is no longer used (it emits a warning now) as validation is the default now. The patch also contains documentation updates for the new options/variables and updates for the NEWS file describing the necessary changes to continue using untrusted packages (but please don't do that - especially as a Debian developer). Please have a look and include the patch as soon as possible to fix this security issue. Regards, Simon - -- System Information: Debian Release: wheezy/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 3.2.0-1-amd64 (SMP w/8 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages pbuilder depends on: ii cdebootstrap 0.5.8+b1 ii coreutils 8.13-3 ii debconf [debconf-2.0] 1.5.41 ii debianutils 4.2.1 ii debootstrap 1.0.38 ii dpkg-dev 1.16.1.2 ii wget 1.13.4-2 Versions of packages pbuilder recommends: pn devscripts 2.11.4 pn fakeroot 1.18.2-1 pn sudo <none> Versions of packages pbuilder suggests: pn cowdancer <none> pn gdebi-core <none> pn pbuilder-uml <none> - -- debconf information excluded -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBCAAGBQJPVWhvAAoJEJL+/bfkTDL5ivAP/iayE8NRQnyk2HW8R+NiRXU3 uavLilwwpmEZyuciu8GxMQIAhT9HYd/DlkhF9I+yBSd30TO3fl0xW7YV9SaIZ+bv IPwnZbHri4KfeV9Zob/gd2jrT9A2QCoFRW0ny4XNCK3NvtWH5KuH+TG2Mq5CQqdN j4VJ3+76oJcbQbU7AUYXfvKDAsEb7gX+VwTEFLS4GrPkni/FIQJ8HHJhlTscyuCD gQANCoRFZHVSMaas3xqi9KYFKgVS4BZ5Z/9FZuLeY5kWBfcbnIhQloVOWTQZIMRI PhnqP1g62XlPu71K3a/Y2RMAcy3Gs6sUbW4OianIr2iskCndejih/MCb+3LmBFCg Ekxi/CcJGrc7a0pV57Qs8Iwkm1siRZZUxcp4xdD3mo9iayoOt4sfFyrvBCYryilQ 7JKpQc3iNoV3EQql6KBu5G+GmFFWHmokpLvVY27n8LgkV2YSb2wrgxqXPfxcYHj7 0j/y2MFw+HOX/d5YSESMLxn9aiZBi7CkMtlMemzqizxlNlL/+OOZiDsi4vdH8L/j Y0c2i9efjNeooc0/B9wASu/Ck8SWV8wW1EcfTag0p9Rp0avy4hoQUmG+MtgQsV0l MQuWWysyxeJFX4Z8ooau82L6sIGC0L073JH6Y/C7uTOz9gKt+e5tV3fnU+pkWpqH oF3CcmlykKX4SYzhUI/e =6EPj -----END PGP SIGNATURE----- >From cadc48fb599d436577a6efedc7f25e175652a3a1 Mon Sep 17 00:00:00 2001 Message-Id: <cadc48fb599d436577a6efedc7f25e175652a3a1.1330997290.git.simon@ruderich.org> From: Simon Ruderich <simon@ruderich.org> Date: Tue, 6 Mar 2012 02:00:48 +0100 Subject: [PATCH] Enforce valid signed repositories by default.
* Note that ${HOME} is usually /root if you run with sudo. (closes: #620337)Junichi Uekawa2012-01-26
| | | | It's probably unexpected for the first time.
* Bug#569917: Support base.tar.xz/bz2 as well as tgzTino Keitel2011-11-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Package: pbuilder Version: 0.203 Followup-For: Bug #569917 I cooked a little patch that adds a --compressprog command line option and COMPRESSPROG option in pbuilderrc. Tested with pigz, to get multithreaded, and therefore much faster compression/decompression, and xz. Debian Release: wheezy/sid APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 3.1.0-00002-g5eeb7f9 (SMP w/4 CPU cores) Locale: LANG=C, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages pbuilder depends on: ii cdebootstrap 0.5.8+b1 ii coreutils 8.13-3 ii debconf [debconf-2.0] 1.5.41 ii debianutils 4.0.4 ii debootstrap 1.0.38 ii wget 1.13.4-1 Versions of packages pbuilder recommends: ii devscripts 2.11.2 ii fakeroot 1.18.1-1 ii sudo 1.8.3p1-2 Versions of packages pbuilder suggests: pn cowdancer 0.65 pn gdebi-core <none> pn pbuilder-uml <none> -- debconf information: pbuilder/mirrorsite: http://ftp.de.debian.org/debian/ pbuilder/nomirror: pbuilder/rewrite: false
* Fix misc man page typosLoïc Minier2010-01-30
|
* Mention quoting around --bindmounts; LP: #376612Loïc Minier2010-01-08
|
* pbuilder: Add --architecture and ARCHITECTURE flagLoïc Minier2009-12-30
| | | | | pbuilder: add support for setting the architecture on the command-line and in pbuilderrc.
* Do not mention codename of testing where possibleLoïc Minier2009-12-14
| | | | | | Avoid mentionning the codename of the current testing distribution where possible as this gets out of date -- except in the rebuild README where the current testig is really what we want.
* Use debootstrap by default instead of cdebootstrapLoïc Minier2009-12-13
|
* Make --debbuildopts additiveLoïc Minier2009-12-12
| | | | | | Change --debbuildopts to be additive and reset the list of options to the empty list if --debbuildopts "" is passed. Update docs and add NEWS entry.
* Add support for building packages twice; #493538Loïc Minier2009-12-11
| | | | | Add support for building packages twice; based on a patch by Nicolas Valcárcel; closes: #493538
* Remove the space before "and"Matt Kraai2009-11-08
| | | | If "and" is preceded by a space, man inserts a newline after --create.
* implement --inputfile option.Junichi Uekawa2009-03-07
| | | | Copies extra files to inside chroot.
* Bug#501390 make debbuildopts description in manpage more verbose suchJunichi Uekawa2009-02-06
| | | | that it is understandable by Drew Parsons.
* Bug#513359: A minor modification to pbuilder.8 (patch)shaul Karl2009-01-29
| | | | | The following patch removes a superfluous new line by putting the word `and' at the beginning of the line.
* Bug#513316: Document the default debootstrap implementationJunichi Uekawa2009-01-29
| | | | cdebootstrap looks like the default, document it in pbuilder.8 manual page.
* [Pbuilder-maint] Bug#422371: Patch for specifying componentsAdrien Cunin2007-10-22
| | | | | | | | | Here is a patch against latest git revision which adds the ability to specify the components either via $COMPONENTS in pbuilderrc or via the command line with --components. It is based on some of the Ubuntu changes [1]. [1] http://patches.ubuntu.com/p/pbuilder/pbuilder_0.170ubuntu1.patch
* * make pbuilderrc example on DEBBUILDOPTS not contain -b, which is not ↵Junichi Uekawa2007-06-20
| | | | recommended.
* add -- to command-line options in manpageJunichi Uekawa2007-06-17
|
* * fix pbuilder.8 manpage example, it was different from real output.Junichi Uekawa2007-06-17
|
* reorganize whitespaceJunichi Uekawa2007-06-15
|
* reorganize manpage ordering and contentsJunichi Uekawa2007-06-15
|
* update manual pages to refer to docbook documentation, and refer to alioth ↵Junichi Uekawa2007-05-27
| | | | web page
* change --logfile option to "tee" and document that changeJunichi Uekawa2007-05-17
|
* --debbuildopts --debootstrapopts documentation clarificationJunichi Uekawa2007-04-16
|
* minor documentation update for etch releaseJunichi Uekawa2007-04-10
|
* 409135: SEE ALSO fix.Junichi Uekawa2007-04-01
|
* 409135: change manual page section SEE ALSO spacingJunichi Uekawa2007-03-28
|
* add EXAMPLES section to documentationJunichi Uekawa2007-01-20
|
* documentation fixdancer2006-10-25
|
* From comment from Sesse, note that thedancer2006-05-27
| | | | | default place build results are placed is /var/cache/pbuilder/result.
* initial cowbuilder support in pdebuilddancer2006-05-24
| | | | | | | | | | | | pbuilder supports pdebuild/cowbuilder login/execute/update/create etc. can also be --login/--execute/--update/--create etc. to cater for cowbuilder documentation updates / XML typesetting fixes. manpage fixes / spellchecking generally what I did while I was on plane trip from Debconf Mexico to Japan.
* updatedancer2006-03-21
|
* +2006-03-18 Junichi Uekawa <dancer@debian.org>dancer2006-03-17
| | | | | | | | | | | | + + * pbuilder.8: update documentation of --pkgname-logfile + + * pbuilder-buildpackage: allow chown, and add support for PKGNAME_LOGFILE_EXTENTION. + + * pbuilderrc (PKGNAME_LOGFILE_EXTENTION): add + + * pbuilderrc.5: document +
* remove support for --nonusmirror.dancer2006-02-22
|
* implement hookdir for workaround of initscripts and cdebootstrap bug.dancer2006-01-29
| | | | add G hooks for pbuilder create.
* [Junichi Uekawa]dancer2005-10-09
| | | | | | | | * Document that --debug option preserves build place. If the following fails, the build directory will remain intact: pbuilder create --distribution etch --basetgz a.tgz --debug (closes: #331635) * README.Debian, pbuilder-doc.xml: updated.
* Change "exec" to "execute" in the description of the --save-after-execkraai2005-09-29
| | | | option.
* + * pdebuild.1: update semantics; left-to-rightdancer2005-08-29
| | | | + * pbuilder.8: update semantics; left-to-right
* +2005-08-07 Junichi Uekawa <dancer@debian.org>dancer2005-08-07
| | | | | | | | | | | | | | | | | | | | | | | | | | + + * debian/control: allow cdebootstrap dependency. + + * testsuite/run-test.sh: complicate the process by testing both + cdebootstrap and debootstrap. + + * pbuilder.8: document --debootstrap + + * pbuilder-checkparams: --debootstrap + + * pbuilder-modules: --debootstrap + + * pbuilder-createbuildenv: unset DEBOOTSTRAPSCRIPT instead of setting + "". The number of parameter given to cdebootstrap changes. + since DEBOOTSTRAPSCRIPT are not supported by cdebootstrap, + Giving cdebootstrap this parameter caused it to fail. + + * pbuilderrc.5: Document DEBOOTSTRAP + + * pbuilderrc (DEBOOTSTRAP): new option. + + * pbuilder-createbuildenv (DEBOOTSTRAPSCRIPT): call ${DEBOOTSTRAP} instead of calling debootstrap directly. +
* +2005-07-10 Junichi Uekawa <dancer@debian.org>dancer2005-07-10
| | | | | | | | | + + * pbuilder-user-mode-linux.1: + * pdebuild-user-mode-linux.1: + * pdebuild.1: + * pbuilder.8: use \- for dash. +
* 312153: synchronize pbuilder and pbuilderrc man pagedancer2005-06-12
|
* +2005-06-05 Junichi Uekawa <dancer@debian.org>dancer2005-06-05
| | | | | | | | | | | + + * debuild-pbuilder.1: + * pbuilder-uml.conf.5: + * pbuilderrc.5: + * pdebuild.1: + * pdebuild-user-mode-linux.1: + * pbuilder.8: add \% escape for URL. +
* --help option for pdebuilddancer2005-06-04
|
* + * pbuilder.8: document --autocleanaptcachedancer2005-06-03
| | | | | | | | + + * pbuilder-updatebuildenv: + * pbuilder-checkparams (AUTOCLEANAPTCACHE): support auto-clean of aptcache + (IGNORE_UMOUNT): add --autocleanaptcache +
* change to use experimental,dancer2005-06-03
| | | | and apply patch; and apply my own patch.
* +pbuilder (0.124) unstable; urgency=lowdancer2005-04-05
| | | | | | | | + + * Update confusing documentation on --debemail option. (closes: #302855) + + -- Junichi Uekawa <dancer@debian.org> Wed, 6 Apr 2005 08:09:25 +0900 +
* +2005-03-04 Junichi Uekawa <dancer@debian.org>dancer2005-03-04
| | | | | | | | | | | | | | | | | | | + + * pbuilder: apply patch frp, Danilo to save aptcache on pbuilder login. + Apply similar change to pbuilder execute. + 271600 + + * pbuilder.8: + * pbuilder-checkparams: + * pbuilder-modules: support --aptcache option + thanks: Danilo Piazzalunga <danilopiazza@libero.it> + 295766 + + * Cleaned build dir for pbuilder-uml #297100 + + * pbuilder-modules (pbuilder-options): document save-after-login/exec + flag in --help output. #296672 +
* 2005-02-13 Junichi Uekawa <dancer@debian.org>dancer2005-02-13
| | | | | | | | | | | | | | | | | | | | | | | | * pbuilder.8: update documentation to include 'sarge' * pbuilder: set umask 0022 in pbuilder. 276589 * pbuilderrc (BUILDRESULT): make default distribution sarge, instead of woody. * pbuilder-modules: update to include sarge in list of distributions; this list is too long, needs some improvement. 289170 * pdebuild: Change build results by default to be owned by the building user, not root:root This change only required for pdebuild only, UML already runs as user. 286397 * pbuilder.8: clarify documentation for 286602, Do not use --debbuildopts -B, but use --binary-arch * Documentation/pbuilder-doc.xml: 293882: Jens Seidel <jensseidel@users.sf.net> small typo fixes. * pbuilderrc (MIRRORSITE): 295032: change default mirror from www.jp.debian.org to ftp.jp.debian.org
* +2004-11-19 Junichi Uekawa <dancer@debian.org>dancer2004-11-19
| | | | | | + + * pbuilder.8: update docs. +
* +2004-10-31 Junichi Uekawa <dancer@debian.org>dancer2004-10-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | + + * Documentation/pbuilder-doc.xml (PBUILDER_UML_IMAGE): add notes on + BUILRESULTUID and SUDO interaction. + + * pbuilder-buildpackage (PACKAGENAME): move around buildresult dir creation before pkgname logfile creation. + + * pbuilder.8: add documentation for --save-after-login/exec option. + + * pbuilder: execute and login with --save-after-login/exec option. + + * pbuilder-user-mode-linux.1: add notes that uml-nocow is effective for exec and login. + + * pbuilder-uml-checkparams (UML_SAVE_AFTER_LOGIN): add UML_NOCOW for exec + + * pbuilder-checkparams (SAVE_AFTER_LOGIN): --save-after-login/exec command-option. + + * pdebuild-user-mode-linux.1: add notes that the option will override + pbuilder option. + + * pdebuild.1: add notes that the option will override pbuilder option + + * pdebuild-user-mode-linux: ditto. + + * pdebuild: override --debbbuildopts in pbuilder option when DEBBUILDOPTS is available and for non-internal mode. +
generated by cgit v1.2.3 (git 2.45.0) at 2024-12-13 20:25:48 +0000